What is the difference for x.509 certificate serial number format in brackets and not in brackets.

Question

I have generated a certificate that has the serial number in such a format 0eaa20f53cacdcaa40fbde51ab50c7d1

I have also seen a certificate with this format. I would like to generate one like this. 10978342379280287625 (0x985ae83a6b9e477f)

How can I do this? Whats the difference?

Solution

An X.509 Serial Number is an integer whose value can be represented in 20 bytes ("or less", because Distinguished Encoding Rules (DER) say you omit any unnecessary leading 0x00 bytes (it's necessary if it changes from a negative to positive number, or if it's the number 0).

10978342379280287625 (0x985ae83a6b9e477f)

If you go to a website that does big number conversions, such as http://www.mobilefish.com/services/big_number/big_number.php you'll see that 985ae83a6b9e477f (hex) is equal to 10978342379280287615 (decimal).

The DER encoded value of this number is 02 09 00 98 5a e8 3a 6b 9e 47 7f

0eaa20f53cacdcaa40fbde51ab50c7d1

This number (DER 02 10 0e aa 20 f5 3c ac dc aa 40 fb de 51 ab 50 c7 d1) is equivalent to the decimal value 19492550873724953657229484824238016465.

Assuming the same software displayed both renderings, like OpenSSL, the difference in whether or not it displays in both decimal and hex likely has to do with the length of the serial number. For OpenSSL the cutoff is 8 content (non-0x00) bytes: https://github.com/openssl/openssl/blob/c4a60150914fc260c3fc2854e13372c870bdde76/crypto/x509/t_x509.c#L88

Since 0x985ae83a6b9e477f fits into an unsigned long, OpenSSL prints it as a decimal value for user convenience.